A friend of mine accidentally pushed his Heroku or New Relic API key to a toy repo which was public and that information was immediately scraped and used. He was billed a non trivial about which he disputed but cost some time and headache.

Enforce best practices and don't do that even if it's for something trivial and won't have real world consequences.